Improper Cryptographic Signature Verification in Edito CMS by Edito

CVE-2026-59074

What is CVE-2026-59074?

Edito CMS is affected by a vulnerability that allows authenticated low-privilege users to bypass cryptographic signature verification in the JWT refresh logic. By submitting a maliciously crafted JWT containing an existing user identifier, an attacker can successfully acquire a valid, fully-signed session token for any user account, including those of administrators. This critical security flaw emphasizes the need for robust signature validation mechanisms to prevent unauthorized access and user impersonation.

References